Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 1.98.63 to 1.99.55. No source URLs, checksums, install scripts, build commands, permissions, or package metadata were altered in the reviewed diff, so there is no new security concern introduced by this change alone. Any risk would come from the upstream binary release itself, which is outside the scope of this single metadata-only update.

@@ -1,6 +1,6 @@
 pkgbase = brave-bin
 	pkgdesc = Web browser that blocks ads and trackers by default (binary release)
-	pkgver = 1.98.63
+	pkgver = 1.99.55
 	pkgrel = 1
 	epoch = 1
 	url = https://brave.com

Comment

The change is a straightforward version bump in .SRCINFO for the Brave binary package: updated provided version, noextract filenames, and upstream GitHub release URLs/checksums for x86_64 and aarch64. The sources remain HTTPS on the official Brave GitHub release path, and there are no new scripts, patches, install hooks, or build-time execution changes in this diff. No supply-chain red flags are introduced by this metadata-only update.

@@ -17,19 +17,19 @@ pkgbase = brave-bin
 	optdepends = cups: Printer support
 	optdepends = libgnome-keyring: Enable GNOME keyring support
 	optdepends = libnotify: Native notification support
-	provides = brave=1.98.63
+	provides = brave=1.99.55
 	provides = brave-browser
 	conflicts = brave
-	noextract = brave-bin-1.98.63-x86_64.zip
-	noextract = brave-bin-1.98.63-aarch64.zip
+	noextract = brave-bin-1.99.55-x86_64.zip
+	noextract = brave-bin-1.99.55-aarch64.zip
 	options = !strip
 	source = brave-bin.sh
 	source = brave-browser.desktop
 	sha256sums = 75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00
 	sha256sums = c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a
-	source_x86_64 = brave-bin-1.98.63-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.63/brave-browser-1.98.63-linux-amd64.zip
-	sha256sums_x86_64 = 2473a889dc41cadf43a2401a442ac0cf9dfb1b0343e7fad88d505749565fca4e
-	source_aarch64 = brave-bin-1.98.63-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.98.63/brave-browser-1.98.63-linux-arm64.zip
-	sha256sums_aarch64 = 898aa0d04e544849abaf6ad15ea29b29bda5c851c64e8f5e302f6e371a82592c
+	source_x86_64 = brave-bin-1.99.55-x86_64.zip::https://github.com/brave/brave-browser/releases/download/v1.99.55/brave-browser-1.99.55-linux-amd64.zip
+	sha256sums_x86_64 = ace5409dfb5a6238e3c09576fab56ef76d31e00ed6d62f10d0b41685ab3fe200
+	source_aarch64 = brave-bin-1.99.55-aarch64.zip::https://github.com/brave/brave-browser/releases/download/v1.99.55/brave-browser-1.99.55-linux-arm64.zip
+	sha256sums_aarch64 = 1b542c83474770a94606e03e4a57536d586b905a22861a3440095729f388e7fc
 
 pkgname = brave-bin

Comment

The change only bumps pkgver from 1.98.63 to 1.99.55 in PKGBUILD. No source URLs, checksums, build steps, install scripts, or packaging logic were modified, so there is no new supply-chain or privilege-escalation risk visible in this diff. Verdict: low risk.

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.98.63
+pkgver=1.99.55
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'

Comment

The change only updates the SHA-256 checksums for the prebuilt Brave ZIP sources on x86_64 and aarch64. The source URLs remain the official Brave GitHub release artifacts over HTTPS, and there are no new build steps, scripts, or packaging logic changes. This is a normal upstream release refresh with no obvious security red flags in the diff provided.

@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('2473a889dc41cadf43a2401a442ac0cf9dfb1b0343e7fad88d505749565fca4e')
-sha256sums_aarch64=('898aa0d04e544849abaf6ad15ea29b29bda5c851c64e8f5e302f6e371a82592c')
+sha256sums_x86_64=('ace5409dfb5a6238e3c09576fab56ef76d31e00ed6d62f10d0b41685ab3fe200')
+sha256sums_aarch64=('1b542c83474770a94606e03e4a57536d586b905a22861a3440095729f388e7fc')
 
 prepare() {
 	mkdir -p brave